Protecting information.
By design.
An operational privacy notice covering public inquiries and the private employee workspace. Review with counsel and your hosting provider before launch.
TRANSPARENCY.
Draft for publication review · October 24, 2026. This text describes functions of the delivered website prototype, not assurances concerning a future hosting vendor or compliance program.
Information collected
When you submit a project inquiry, the site collects your name, work email address, company, organizational category, requested service, timeline and message. Consent to be contacted is recorded with the inquiry. Do not send patient health information, participant-level data or confidential datasets through the inquiry form.
The private employee workspace may collect an employee username and profile, assigned studies, study milestone statuses, team messages, project dates, document metadata returned from an approved SharePoint library, and time entries. The application authenticates users using an HTTP-only session cookie.
How information is used
Inquiry information is used to respond to requests for business discussions. Portal information supports COTA's internal study coordination and timekeeping. Authorized administrators may view business inquiries; workspace data access is restricted based on assigned study and role, subject to further production security review.
Storage, retention and sharing
This implementation uses locally hosted SQLite databases on a server controlled by the site operator. It does not send inquiry submissions through third-party email marketing services. If a Microsoft 365 SharePoint connection is configured, the prototype accesses document names, URLs and modification timestamps through Microsoft Graph; it does not ingest file contents. Hosting location, backup access, retention schedules, deletion processes, data processing agreements and international transfers must be approved before publication.
Third-party sources and links
The Research Intelligence page may retrieve public articles and statistics from FDA, NIH, EMA and SAS publishers. External links take visitors to sites with separate terms and privacy practices. Font assets may be requested from Google Fonts unless removed or self-hosted for production.
Security and employee access
Encrypted HTTPS, secure cookies, administrator-managed credentials, MFA or enterprise SSO, least-privilege permissions, audit logging, backup routines and incident response must be configured and assessed before live study coordination. This prototype should not be used to store regulated participant data or as a validated GxP platform.
Contact
Questions about COTA's website data handling can be sent using the project submission form.